Fortinet FortiGate-800 manual Policy routing examples, Routing a service to an external network

NAT/Route mode installation Configuration example: Multiple connections to the Internet

Policy routing examples

Adding policy routing increases your control over how packets are routed. Policy routing works on top of destination-based routing. To increase the control provided by destination-based routing, configure destination-based routing first and then build policy routing on top.

For example, if you use destination-based routing to configure routing for dual Internet connections, you can use policy routing to better control which traffic is sent to which destination route. This section describes the following policy routing examples, based on topology similar to that shown in Figure 9 on page 51. Differences are noted in each example.

The policy routes described in these examples work only if you have already defined destination routes similar to those described in the previous section.

•Routing traffic from internal subnets to different external networks

•Routing a service to an external network

For more information about policy routing, see “Policy routing” on page 156.

Routing traffic from internal subnets to different external networks

If the FortiGate unit provides Internet access for multiple internal subnets, you can use policy routing to control the route that traffic from each network takes to the Internet. For example, if the internal network includes the subnets 192.168.10.0 and 192.168.20.0 you can enter the following policy routes:

1Enter the following command to route traffic from the 192.168.10.0 subnet to the 100.100.100.0 external network:

set system route policy 1 src 192.168.10.0 255.255.255.0 dst 100.100.100.0 255.255.255.0 gw 1.1.1.1

2Enter the following command to route traffic from the 192.168.20.0 subnet to the 200.200.200.0 external network:

set system route policy 2 src 192.168.20.0 255.255.255.0 dst 200.200.200.0 255.255.255.0 gw 2.2.2.1

Routing a service to an external network

You can use the following policy routes to direct all HTTP traffic (using port 80) to one external network and all other traffic to the other external network.

1Enter the following command to route all HTTP traffic using port 80 to the next hop gateway with IP address 1.1.1.1.

set system route policy 1 src 0.0.0.0 0.0.0.0 dst 0.0.0.0

0.0.0.0protocol 6 port 80 80 gw 1.1.1.1

2Enter the following command to route all other traffic to the next hop gateway with IP address 2.2.2.1.

Set system route policy 2 src 0.0.0.0 0.0.0.0 dst 0.0.0.0

0.0.0.0gw 2.2.2.1

FortiGate-800 Installation and Configuration Guide 55